Nonorthogonal decoy-state Quantum Key Distribution 
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In practical quantum key distribution (QKD), weak coherent states as the photon source have a 
limit in secure key rate and transmission distance because of the existence of multiphoton pulses and 
heavy loss in transmission line. The decoy-state method and the nonorthogonal encoding protocol 
are two important weapons to combat these effects. Here, we combine these two methods and 
propose an efficient method that can substantially improve the performance of QKD. We find a 
78 km increase over the prior record using the decoy-state method and a 123 km increase over the 
result of the SARG04 protocol in transmission distance. 

PACS numbers: 03.67.Dd 



Quantum key distribution (QKD)Jl], Q allows two 
users, Alice and Bob, to communicate in absolute secu- 
rity in the presence of an eavesdropper, Eve. Unlike con- 
ventional cryptography, the security of QKD is based on 
the uncertainty principle and the noncloning theorem Q . 
In other words, the measurement of an unknown quan- 
tum state modifies the state itself. Thus, Eve cannot gain 
any information on the key without introducing any error 
in the correlations between Alice and Bob. However, in 
practical implementations, an attenuated laser pulse (a 
weak coherent state)is often used as the source. The ex- 
istence of multiple photon pulses, even though very rare, 
poses a serious problem for the security of the protocol, 
especially in high lossy channel. An eavesdropper (Eve) 
can in principle have the full information of Bob's sifted 
key by using the photon-number-splitting (PNS)attack 
0, 01 Q : Eve blocks all single-photon pulses and part of 
multi-photon pulses and separates each of the remained 
multi-photon pulses into two parts therefore each part 
contains at least one photon. She keeps one part and 
sends the other part to Bob, through a lossless channel. 

Recently, two important methods have been proposed 
to overcome PNS attacks. One is the decoy-state method 
firstly proposed by Hwang J7|, and further studied by 
Wang and also Lo and co-workers 0, [ljj. Partic- 
ularly, by combining the idea of the entanglement dis- 
tillation approac h by Gottesman, Lo, Lutkcnhaus, and 
Preskill (GLLP) [llj with the decoy state method, they 
achieved a formula for secure key generation rate [9j : 

S > q{-Q^f(E^)H 2 (E^ + Q 1 [l - ff 2 (ei)]}, (1) 

where q is the sifting efficiency depending on the imple- 
mentation (1/2 for the BB84 protocol, because half the 
time Alice and Bob bases are not compatible), Q M and 
are the gain (i.e., counting rate p|) and quantum bit 
error rate (QBER) of the signal state respectively, and 
can be measured directly, Q\ and e\ are the gain and 



QBER of single-photon states respectively, and can be es- 
timated by using decoy state method, f{E^) is the error 
correction efficiency 12], and H 2 is the binary Shannon 
entropy, given by: 



H 2 (x) = -x\og 2 {x) - (1 - x)log 2 (l - x). 



(2) 
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The other is the nonorthogonal states encoding protocol 
proposed by Scarani, Acin, Ribordy and Gisin (SARG04) 

f, which uses exactly the same four states as in BB84 
and only the classical sifting procedure is different 
from BB84: instead of revealing the basis, Alice an- 
nounces publicly a pair of nonorthogonal states. Thus, 
Eve needs at least three photons to obtain full informa- 
tion. This means one can utilize the two-photon part to 
generate a secure key. However, either the decoy state 
method or the nonorthogonal states encode protocol has 
no further security analysis on it. 

In this paper, we first present a simple method that can 
study the secure key generation rate when single-photon 
and two-photon pulses are employed to generate secure 
key. The structure of the paper is as follows. First, we 
derive a formula for secure key generation rate, where 
two-photon part is included. Next we present a simple 
method that will give a tight bound to Qq, Q\, e\, Q 2 
(the gain of two-photon states)and e 2 (the error rate of 
two-photon states) respectively. Then we present the ad- 
vantage of this new protocol at secure key generation rate 
and transmission distance by comparing with the results 
m @. Finally, we discuss and conclude. 

Our new GLLP formula. The secure generation rate 
must include the two-photon part when we use SARG04 
protocol. So we need to modify Eq. to satisfy our 
purpose. 

Theorem The key generation of an nonorthogonal en- 
coding scheme is given by: 

S > q{-Q^H 2 (E„)+Qo+Qi[l-H 2 (e 1 )}+Q2[l-H 2 (e 2 )}}, 

(3) 

where q is 1/4 for SARG04, and Qq is the gain of the 
vacuum signals. 

Now, let us prove it. According to the Csiszar-Korner 
theorem |l4j : if the mutual information Alice-Bob is 
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larger than either the mutual information Alice-Eve or 
Bob-Eve, then Alice and Bob can distil a secret key. The 
secure key generation in QKD satisfies 



S > I (A : B) — I(B : E), 



(4) 



where I{A : B) and I(B : E) are mutual information of 
Alice-Bob and Bob-Eve respectively, and are given by: 

I(A:B) = qQ u (l-H 2 (E u )) (5) 
I(B:E) = q{Q 1 H 2 (e 1 ) + Q 2 H 2 (e 2 ) + Y,Qn}, (6) 

n>3 

where Q n is the gain of n-photon states, and q is 1/4 
for SARG04. The vacuum signals do not contribute to it 
at all because of the mutual information of vacuum be- 
ing zero. Here, we take the most conservative assumption 
that Eve has all the information on all tagged pulses (the 
parts for photon number n > 3) and obtains full informa- 
tion stemming from the QBERs e\ and e 2 . Combining 
Eq. (@J and Q u = ^2 n>0 Qm we S e * * ne res ult of our 
theorem. In fact Eq. Q can be generalized from Lo's 
theorem directly if only adding the secure generation 
rate of the two-photon part. As discussed in [jj, practical 
error correction protocols are generally inefficient. Thus, 
the secure key generation rate for practical protocols is 
given by: 

S > q{-Q u f(E u )H 2 (E u ) +Q + Q l [i- H 2 (ei)] 

+Q 2 [l-H 2 (e 2 )}}. (7) 

The optimal secure key generation rate without decoy 
states. Although we have obtained the Eq. (JJJ that can 
calculate the secure key generation rate for the SARG04 
protocol, we have to discard the it due to the presence of 
Eve. In this case, Eve can block all single-photon pulses 
or all two-photon pulses, she can get more information, 
so the worst secure key generation rate is given by 

S WO rst = \(-Quf(E u )H 2 (E^ + Q + nQ u [l~H 2 (^)}), 

(8) 

where f{E a ) = 1 for convenience, and f2, the fraction of 
untagged photons, satisfies 



n = i 



(1 +/i + ^72)e^ 



(9) 



Sworst is optimised if we choose /i = ^optimal , which ful- 
fills 



-^optimal 



(10) 



Since for realistic setup we expect that 77 <gc 1, we find 

^optimal ~ 

The lower bound of the secure key generation rate with 
decoy states. A verified lower bound of secure key gener- 
ation rate can be obtained by using decoy-state method. 



This method is dependent on the real-world QKD pro- 
tocols deeply. In practical implementations, a weak co- 
herent state (i.e., a dephased coherent state) is a mixed 
state of 

/df) 
-|^)(^'1^p„MI/')(H, (11) 



where -P«.(aO — — an d M is the mean photon number. 
The gain, Q Ul and QBER, E u , are given by 



Qu — ^ , Qn 

n>0 

'±E u ^ QnC n 



(12) 
(13) 



n>0 



and Q n = Y n P n (/j,), where e n and Y n are respectively the 
error rate and yield of the n-photon state. In the normal 
case that there is no eavesdropper, Q a and E a are given 



Qn = Y + l-e 
Q U E U = e Y + e d et(l 



(14) 
(15) 



where e^et is the probability that a photon hit the erro- 
neous detector, r\ is the overall transmission probability 
of a photon. 

In the presence of an eavesdropper, Eve, we can use the 
decoy-state method to detect Eve's attacks. The essence 
of decoy state idea is that Eve cannot distinguish the de- 
coy state from the signal state. So the signal state and 
the decoy state have the same values for the yield, Y n , 
and QBER, e„ . In order to achieve the unconditional se- 
curity of QKD with the key generation rate given by Eq. 

we must consider now how to use the decoy state 
idea to estimate Qg, Qi, e±, Q 2 and e 2 . A similar prob- 
lem for orthogonal encoding protocols has been analyzed 
explicitly by Lo and his co-workers in |10|. Here we ex- 
ploit their method to solve the question in nonorthogonal 
protocols. 

For simplicity, we propose a specific protocol that uses 
only four decoy states: vacuum and three weak decoy 
states. The vacuum can be used to estimate the back- 
ground rate, 



Yq — Q l 



; vacuum j 

e -F I 

t-0 — -^vacuum — n • 



(16) 



The dark counts occur randomly; thus the error rate of 
the the dark count is 1/2. The signal and three decoy 
states with expected numbers /i, v\, v 2 and v% satisfy 

2 3 
< u 3 < v 2 < -n < v\ < -fi, 



v x +v 2 > n, 
v 2 + v z < [l. 



(17) 
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Alice and Bob will get the following gains and QBERs 
for signal state and these three decoy states: 



}^ = Y + Y lt x + 



Y 2[ i 2 



z=3 



oo 



i=3 



Q^e Vl = y, + Y lVl + + ^ y^, 



E Vl Q vl e' /1 = e y + eiYii/i 



2 — z! 

i=3 

e 2 y 2 ^ , ^ „i4 

^i 1 i . i • 



Q^c* = y + y^ 2 



i=3 

2 °° i 

2 

i=3 



E V2 Q V2 e U2 = e y + e{Y]V 2 



2 + 2^ e ^ z! ' 

i=3 



Ey 3 Q V3 e V3 = e y + eiyi/3 



e2y2^ : 



i=3 
2 



c?,y, .. ■ 



i=3 



(18) 

Alice and Bob can estimate the lower bound of Y\ and 
the upper bound of e\ from Eq. ifTHl) by using decoy 
states v 2 and v 3 . The lower bound of Y\ is given by 



<yi(-2-K3) + ^E l > 2 J if 

= Y 1 {u 2 -u 3 ) + ^-(Q^-Y -Y 1 ^). (19) 

Here, in order to prove the inequality in Eq. I|19|) . we 
have made use of the inequality that a % — b % < a 2 — b 2 
whenever < b < a < |, a nd i > 2. The last equality 
sign holds in the in Eq. i|19(l if and only if Eve raises the 
yield of two-photon states and blocks all the states with 
photon number greater than 2. In fact Eve will not take 
this tactics because she cannot achieve full information 
on two-photon state. The upper bound of e\ is given by 

E V3 Qu 3 e Us = e Y + e x Yiv 3 + YZ2 e ^lf 

> e y + eiFn*. (20) 

By solving Eq. lfH?)l and Eq. (|2U)l , the lower bound of Yi 
and upper bound of e\ are given by 

y > 

_ ^(QvX 2 - Qu 3 e^) - (v 2 - 4){Q^ - Y ) 



ex < e u x = 



\j?(y 2 - u 3 )(/i -h> 2 - V3) 
Y x L v 3 



(21) 



Then, according Qi — YiPi(n), the gain of single-photon 
states is given by 

Qi > Qi =y i i /ie" M - (22) 



Next, Alice and Bob can estimate the lower bounds of 
Y 2 and the upper bound of e 2 respectively by using decoy 
states z/i, 1/2 and v 3 from Eq. I|18(l under conditions Eq. 
(|17fl . The lower bound of Y 2 is given by 

= Y x {v x v 2 ) + \{v\ v\) + E,> 3 £ K - 4) 

< y(^i - 1*) + 4) + ^E,> 3 ¥ 
+^ Ei> 3 (Q^ - y - y/i - ^f) 



Ei>s(Q^ -Y -^f ).(23) 



In order to prove the inequality in Eq. 123|) . we have 
made use of the inequality that a 1 —b % < a 2 — b 2 whenever 
< b < a < §, and i > 3. The last equality sign 
holds in Eq. I|23l) if and only if Eve raises the yield of 
three-photon states and blocks all the states with photon 
number greater than 3. In addition, to obtain the last 
sign equality in Eq. Q23JI. we have let v\ and v 2 satisfying 



v x - v 2 



(24) 



The upper bound of e 2 is given by 



E V3 Q V3 e V3 = e Y + etY^ + ^j^- + ££ 3 



> eo^o H 2"' 



(25) 



By solving Eq. lf2*37l and Eq. l(2*5|l , the lower bound of Y 2 
and Q 2 and upper bound of e 2 are given by 



y 2 > y 2 l 



2n(Q Vl e"i - Q V2 e^) - 2{v x - u 2 ){Q^ - Y ) 



[l{vx - v 2 ){yi + v 2 - fi) 



Q2 > Q L 2 = 



Y 2 L n 2 e-v 



. v 2E v ,Q v ,e^ -2e y 
e 2 S e 2 - 77T72 ■ 

J 2 ^3 



(26) 



Now, the lower bound of the secure key generation rate, 
according to Eq. Q, is given by: 

S L = q{-Q^(E^H 2 (E^ + Q + Q\ [1 - H 2 (f%)\ 

+Q^[l-H 2 (e^)]},(27) 



where Q = Y e~^ = Q V acuu m e~ tA '. Comparing our re- 
sult (given in Eq. Q) with the prior result in 10] (given 
in Eq. Q), we see that the main difference is that in our 
result, two additional terms, Qo and Q\ [1 — H 2 (e^)], can 
also generate secure keys. To fix the ideas, we will com- 
pare our protocol with the SARG04 protocol and BB84 
protocol according Eqs. J7J JSJ and JQ) respectively in 
the following paragraph. 

For simplicity, We only consider the asymptotic case 
(i.e. omit statical fluctuations of Q n and e„). By using 
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FIG. 1: (a)The optimal secure generation rate for SARG04 
protocol without decoy states, (b)The optimal secure gener- 
ation rate for BB84 protocol with decoy states (n = 0.48), 
(c) The secure generation rate for our protocol by using the 
formula 1271 (u = 0.48), (d) The secure generation rate for 
our protocol by using the formula 1271 (/i = 0.30). The pa- 
rameters is given according to experiment GYS 16]: a — 
0.21dB/km, e det = 3.3%, Y = 1.7 x 10~ 6 , and the detection 
efficiency of Bob's setup n B ob = 0.045. /(£ M ) = 1.22. 



the GYS |16( experiment as an example, the result shows 
in Fig. 1. The curve (a) is the optimal secure generation 
rate for SARG04 protocol without decoy states achieved 
by using Eq. © . The curve (b) is a simple repeat of Ref. 
9] for BB84 protocol with decoy states. We note that our 
protocol is better than both SARG04 protocol without 
decoy states and Lo's protocol at any distance. The max- 
imal distances of the three protocols are 220, 142, and 97 
km respectively. Theoretically, we can achieve a longer 
transmission distance with our method when we decrease 
the value of /i. In these cases, however, the weak decoy 
state method cannot work efficiently due to the statical 
fluctuations. 

In summary, we have proposed an efficient and feasible 
nonorthogonal decoy-state protocol to do QKD over very 
lossy channel, we have clearly demonstrated how to es- 
timate the lower bound of the secure key generation rate 
in this new protocol. Our result shows that, the combi- 
nation of decoy state method and nonorthogonal states 
encoding protocol can make great progress at the secure 
key generation rate. Our protocol can be realized easily 
because it is the same as Lo's protocol in operation. 

J. -B.Li thanks Xiongfeng Ma for his kind help with nu- 
merical calculations. This work is supported by Scientific 
Research Fund of Hunan Provincial Education Depart- 
ment No. 03c213. 



[1] N. Gisin, G. Ribordy, W. Tittel, & H. Zbinden, Rev. 
Mod. Phys. 74, 145 (2002). 

[2] C. H. Bennett, & G. Brassard, Proceedings of IEEE In- 
ternational Conference on Computers, Systems, and Sig- 
nal Processing, IEEE, 1984, pp. 175-179. 

[3] W. K. Wootters and W. Zurek, Nature (London) 299, 
802 ( 1982). 

[4] B. Huttner, N. Imoto, N. Gisin, and T.Mor, Phys. Rev. 

A 51, 1863 (1995). 
[5] N. Liitkenhaus, Phys. Rev. A 61, 052304, (2000). 
[6] G. Brassard, N. Liitkenhaus, T. Mor, and B. C. Sanders, 

Phys. Rev. Lett. 85, 1330 (2000); N. Liitkenhaus, and M. 

Jahma, New. J. Phys. 4, 44 (2002). 
[7] W.-Y. Hwang, Phys. Rev. Lett. 91, 057901 (2003). 
[8] X.-B. Wang, Phys. Rev. Lett. 94, 230503 (2005); X.-B. 

Wang, Phys. Rev. A 72, 012322 (2005). 



[9] H.-K. Lo, X.-F. Ma, and K. Chen, Phys. Rev. Lett. 94, 
230504 (2005). 

[10] X.-F. Ma, B. Qi, Y. Zhao, and H.-K. Lo, Phys. Rev. A 

72, 012326 (2005). 
[11] D. Gottesman, H.-K. Lo, N. Liitkenhaus, & J. Preskill, 

Quantum Info, and Comp. 4, No. 5 (2004) 325-360. 
[12] G. Brassard, & L. Salvail, Advances in Cryptology, Eu- 

rocrypt' 93 Proceedings (1993), pp. 410-423. 
[13] V. Scarani, A. Acin, G. Ribordy, and N. Gisin, Phys. 

Rev. Lett. 92, 057901 (2004). 
[14] I. Csiszar and J. Korner, IEEE Trans.Inf. Theory IT-24, 

339 (1978^ 

[15] H.-K. Lo, quant-ph/0503004 

[16] C. Gobby, Z. L. Yuan, & A. J. Shields, Appl. Phys. Lett. 
84, 3762 (2004). 



